cable-service/cable.conf

###
### Apache configuration file for Signal-Server
### 

### VirtualHost for the main service:

<VirtualHost *:443>
	ServerName cable-service.cable.im
	SSLEngine On

	# Per il servizio Signal vero e proprio usiamo invece il certificato self-signed.
	# Nel keystore del'app Android è il root certificate della nostra CA, assicurando
	# così che l'app riconosca come validi solo i certificati emessi dalla nostra CA.

	SSLCertificateFile /home/cable/certificati/whisper.crt
	SSLCertificateKeyFile /home/cable/certificati/whisper.key
	Include /etc/letsencrypt/options-ssl-apache.conf
	#SSLCertificateChainFile /home/cable/certificati/whisper.crt

	# Per proxare websocket (ws://) serve questa roba:
	#
	# https://httpd.apache.org/docs/2.4/mod/mod_proxy_wstunnel.html

	ProxyVia On
	ProxyPreserveHost On
	ProxyPass / ws://127.0.0.1:4242/
	ProxyPassReverse / ws://127.0.0.1:4242/
</VirtualHost>


### VirtualHost for letting Twilio call back:

<VirtualHost *:443>
	ServerName cable-service-ca.cable.im
	SSLEngine On

	# Su cable-service-ca.cable.im serve un certificato valido (letsencrypt).
	# È l'hostname a cui si connette Twilio per ottenere le informazioni
	# necessarie a fare la verifica del numero tramite chiamata vocale.

	SSLCertificateFile /etc/letsencrypt/live/cable-service-ca.cable.im/cert.pem
	SSLCertificateKeyFile /etc/letsencrypt/live/cable-service-ca.cable.im/privkey.pem
	Include /etc/letsencrypt/options-ssl-apache.conf
	SSLCertificateChainFile /etc/letsencrypt/live/cable-service-ca.cable.im/chain.pem

	ProxyVia On
	ProxyPreserveHost On
	ProxyPass / http://127.0.0.1:4242/
	ProxyPassReverse / http://127.0.0.1:4242/
</VirtualHost>


### Giphy proxy:

<VirtualHost *:80>
	ServerName giphy.com
	ServerAlias *.giphy.com
	ProxyRequests On
	ProxyVia Block
	ProxyPreserveHost On

	# The AllowConnect directive specifies a list of ports
	# to which the proxy CONNECT method may connect.
	AllowConnect 443

	# Only allow HTTP CONNECT requests, denying the others (GET, POST, ...).
	<Location />
		<LimitExcept CONNECT>
			Order allow,deny
			Deny from all
		</LimitExcept>
	</Location>

	<Proxy *>
		Order allow,deny
		Deny from all
	</Proxy>

	<Proxy "*.giphy.com:443">
		Allow from all
	</Proxy>
</VirtualHost>